JP3622433B2 - Access credential authentication apparatus and method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an access credential authentication technique for authenticating a user's access qualification.
[0002]
[Prior art]
A program execution control technique is known as a prior art belonging to the same field as the present invention. Program execution control technology
(1) A routine for user authentication is embedded in the application program. (2) The routine checks that the user who is attempting to execute the application has a proper authentication key.
{Circle around (3)} A technique for continuing the program only when the existence of the authentication key is confirmed, and stopping the execution of the program otherwise. By using this technology, it is possible to execute an application program only for a legitimate user having an authentication key. This technology has been put into practical use in the software distribution business, and as a product, for example, Rainbow Technologies, Inc. Sentinel SuperPro (trademark), Aladdin Knowledge Systems Ltd. HASP (trademark) of the company.
[0003]
Hereinafter, the program execution control technique will be described in more detail.
(1) A user who executes software has an authentication key as user identification information. The authentication key is a key for encryption, and is distributed to the user by a person who is permitted to use the software, for example, a software vendor. The authentication key is strictly enclosed in a memory or the like in hardware to prevent duplication, and is delivered to the user using physical means such as mail.
(2) The user attaches the hardware with the built-in authentication key to his / her own personal computer / workstation by the designated method. The hardware is attached to, for example, a printer port.
(3) When a user starts an application program and the execution of the program reaches the user authentication routine, the program communicates with hardware incorporating a user authentication key. Based on the result of the communication, the program identifies the authentication key, and when the presence of the correct authentication key is confirmed, execution proceeds to the next step. If communication fails and the presence of the authentication key cannot be confirmed, the program stops itself so that it cannot be executed later.
[0004]
Identification of the authentication key by the access qualification authentication routine is performed according to the following protocol, for example.
(1) The access qualification routine generates an appropriate number and sends it to the hardware with a key.
(2) The key built-in hardware encrypts the number sent using the built-in authentication key and returns it to the authentication routine.
{Circle around (3)} The authentication routine determines whether or not the returned number is a number that is predicted in advance, that is, a number obtained by encrypting the number transmitted to the hardware with a correct authentication key.
(4) If the number returned is equal to the expected number, execution of the program is continued, and if not, the program is stopped.
[0005]
At this time, the communication between the application program and the hardware with a built-in authentication key must be different every time it is executed even if it is exchanged with the same hardware at the same location in the same application program. Otherwise, the contents of communication in the normal execution process are recorded once, and the program can be executed even by a user who does not have the correct authentication key by returning to the application program as recorded every time the program is executed. Will be possible. Such illegal execution of the application program by reproducing the communication content is called a replay attack.
[0006]
In order to prevent a replay attack, normally, a random number newly generated every time communication is used as the number sent to the hardware with a key.
[0007]
[Problems of conventional technology]
The problem with the prior art stems from the nature that when creating an application program, the program creator must preliminarily assume the user's authentication key and then perform program protection processing based on the authentication key. To do.
[0008]
That is, the program creator must predict a correct reply from the hardware with a built-in key at the time of creating the program, and create the program so that the program is executed normally only when the correct reply is received.
[0009]
There are basically two types of usage of the prior art having the above characteristics, but in either case, there are problems described below.
[0010]
{Circle around (1)} In the first method, user authentication keys are prepared differently for each user. That is, one different authentication key is prepared for each user, such as authentication key A for user A and authentication key B for user B.
[0011]
In this case, the program creator needs to create a program by appropriately changing the authentication routine in the program for each user. In other words, since the authentication key is different for each user, the authentication routine in the program must be created so as to identify the authentication key specific to the user who uses the program, and the program creator differs by the number of users. Need to create.
[0012]
When there are a large number of target users, the task of individualizing the program for each user requires labor that cannot be tolerated by the program creator, and the list of user authentication keys that must be managed becomes enormous.
[0013]
(2) In the second method, the program creator prepares a different authentication key for each application. That is, a different authentication key is prepared for each application, such as an authentication key A for the application A and an authentication key B for the application B, and each application program is created so as to identify a unique authentication key.
[0014]
In this method, it is not necessary to individually create a program for each user as in the case of the first method, but on the contrary, the user must hold authentication keys for the number of applications to be used. .
[0015]
This restriction raises the following problems for each program creator and user.
[0016]
As described above, the authentication key needs to be distributed to users in a state of being strictly enclosed in hardware. Therefore, in contrast to the program itself being able to be easily distributed via the network, the distribution of the hardware containing the authentication key has to rely on physical means such as mail. This restriction places a heavy burden on the program creator regardless of cost, time, and packaging.
[0017]
In order to respond to the user's request, the program creator must stock a certain number of different hardware for each application, which requires inventory management costs.
[0018]
In addition, the user must be relieved by the complexity of having to replace the hardware every time the application to be used is changed.
[0019]
Even if the user wants to use an application, the user has to wait until the hardware in which the authentication key is enclosed arrives, which causes inconvenience in that it cannot be used immediately.
[0020]
In order to reduce this burden, multiple authentication keys are encapsulated in hardware in advance, and an unused authentication key in hardware can be used every time a user is allowed to use a new application. A method such as telling the user the password is used. However, even if this method is used, it is clear that the above-mentioned problem cannot be solved in principle. Actually, when commercializing, in order to alleviate the inconvenience caused by the above-mentioned problems, the hardware is designed to be connected and coupled together.
[0021]
As described above, even if any of the above two methods is adopted, there is a problem in the convenience of the program creator and the user.
[0022]
Considering the external characteristics of execution control, it can be imagined that it can also be applied to privacy protection of mail, access control of files and computer resources, and other general digital content access control. However, it is impossible to apply the prior art to these fields due to the above problems.
[0023]
[Problems to be solved by the invention]
The present invention has been made in view of the above circumstances, and solves the problems caused by handling a large number of unique information such as authentication keys that occur on both the user side and the protect side such as the application creator. , Simply authenticate user access qualifications when performing program execution control, access rights protection for digital content (still images, movies, audio, etc.), email privacy protection, file and computer resource access control, etc. The purpose is to provide an access qualification authentication technology.
[0024]
[Means for solving the problems]
According to the present invention, in order to achieve the above-mentioned object, the access credential authentication apparatus for authenticating the access qualification of the user by verifying the validity of the signature generated to prove the authority of the user, The first storage means for storing the unique information, the second storage means for storing the unique information of the user, the unique signature key calculated from the signature key, and the user held in the first storage means First generation means for generating a pre-signature using the unique information of the second, second generation means for generating a signature using the user's unique signature key held in the second storage means, Verification means for verifying the validity of the signature generated by the generation means is provided, and the first generation means and the second generation means cooperate to generate a signature.
[0025]
In this configuration, by introducing a unique signature key (access ticket), the characteristic information of the access qualification authentication and the user specific information can be made independent. Therefore, the protect side and the user side prepare one specific information. Just do it.
[0026]
An access ticket is data calculated based on specific information of a specific user and characteristic information of access credential authentication, and also calculates characteristic information of access qualification authentication from the access ticket without knowing the user specific information. It is difficult. The correct proof data is calculated only when the correct combination of the user-specific information and the access ticket, that is, the combination of the user-specific information and the access ticket calculated based on the user-specific information is input. . Therefore, the user holds the unique information in advance, and the protector such as the program creator prepares the characteristic information of the access qualification authentication independently of the unique information possessed by the user, and creates the access ticket as the user's unique information and application program. It is possible to authenticate the access qualification of the user such as execution control by creating and distributing it according to the characteristic information of the access credential authentication used for the above.
[0027]
The present invention can also be realized as a method. Furthermore, at least a part of the present invention can be realized as a program product.
[0028]
BEST MODE FOR CARRYING OUT THE INVENTION
[Overall configuration]
Hereinafter, the present invention will be described in detail. Before describing specific individual examples, an overview of embodiments of the present invention will be described below.
[0029]
First, a case where the present invention is used for execution control of an application program operating on a user's PC or workstation will be described. FIG. 1 shows the configuration of the apparatus in this embodiment.
[0030]
In FIG. 1, a program execution control device (user authentication device) includes a proof data verification device 10, a proof data generation device 11, and an access ticket generation device 12. The proof data verification device 10 includes verification means 13 and holds authentication data 14. The proof data generation device 11 includes a signature data generation unit 15 and a pre-signature data generation unit 16 and holds user unique information 17 and a unique signature key (access ticket) 18. The access ticket generation device 12 generates an access ticket 18 and supplies it to the proof data generation device 11. The access ticket 18 will be described in detail later.
[0031]
The proof data verification device 10 sends the authentication data 14 to the proof data generation device 11. The signature data generation unit 15 and the pre-signature data generation unit 16 of the proof data generation device 11 include the received authentication data 14, user-specific information (specific information for identifying a user) 17, and an access ticket 18. Proof data (signature) is generated from the above and returned to the proof data verification device 10. The verification means 13 of the proof data verification apparatus 10 verifies the signature, and if the verification is successful, execution of the program is permitted.
[0032]
In this embodiment, the proof data generation device 11 can be realized as a proof program on a computer used by a user. At this time, if the user can copy and distribute the unique information (user unique information) 17 for identifying the user, the user who does not have a valid usage right is allowed to use the application program. Become. Therefore, the user-specific information 17 is attached to the computer so that even a user who is a legitimate holder thereof cannot steal it. ) Is preferably used in combination. At this time, if portable hardware such as an IC card is used, it is convenient for a user to work on a plurality of PCs or workstations.
[0033]
The proof data verification device 10 is configured as a part of an application program used by a user. That is, when a user starts an application program on a PC or a workstation, the proof data verification device 10 described as a program in the application program is started, communicates with the proof data generation device 11, performs user authentication, and communicates. The application program can be executed only when it is correctly terminated.
[0034]
In order for the user to use the application program in which the proof data verification device 10 is embedded, it is necessary to acquire a unique signature key (access ticket) issued to the user himself / herself and corresponding to the application program. The user registers the acquired access ticket in the certification data generation program installed on the PC or workstation and, for example, when user-specific information is enclosed in the IC card, the IC card is inserted into the PC. Or attach to the workstation. The access ticket may be placed on the PC or workstation, or may be placed in an IC card.
[0035]
The proof data generation device 11 (comprised of a program on the PC or workstation and an IC card) calculates based on the user specific information 17 and the access ticket 18 and communicates with the proof data verification device 10 based on the calculation. I do. The user specific information 17 is used in the process of this calculation. However, since there is a problem if the user specific information 17 leaks outside, at least a part of the program needs to be protected by a protection means such as an IC card.
[0036]
As a result of the communication, the authentication by the proof data verification device 10 succeeds because the user-specific information 17, the access ticket 18, and the access qualification authentication feature information verified by the proof data verification device 10 correspond correctly. Limited to cases.
[0037]
If either the user specific information 17 or the access ticket 18 is missing, the authentication is not successful.
[0038]
The access ticket 18 is issued to a specific user. That is, when the access ticket 18 is generated, the user specific information 17 of a specific user is used. If the user-specific information 17 used when generating the access ticket 18 and the user-specific information 17 used by the proof data generation device 11 do not match, authentication will not succeed.
[0039]
Further, the access ticket 18 is generated based on the characteristic information of the specific access qualification authentication, and the proof data verification device 10 is configured to authenticate the characteristic information of the access qualification authentication. Therefore, even when the feature information that generated the access ticket does not correspond to the feature information to be authenticated by the proof data verification device 10 embedded in the application program, the authentication is not performed. Not successful.
[0040]
Further, the application program may be executed on another computer coupled by a network, and the execution result may be communicated to the computer used by the user via the network. In this case, the configuration is based on a so-called server / client model. In the case of execution control of the application program executed on the user's PC or workstation as described above, the communication between the proof data generation device 11 and the proof data verification device 10 is executed as so-called interprocess communication. On the other hand, when the server-client model is followed, the communication between the proof data generation device 11 and the proof data verification device 10 is communication according to a network protocol such as TCP / IP (Transmission Control Protocol / Internet Protocol). Executed.
[0041]
The present invention can also be applied when the application program is configured on a dedicated device. For example, it is assumed that the entire proof data generation device 11 is mounted in an IC card, and the acquired access ticket 18 is also registered in the IC card. The proof data verification device 10 is mounted on the dedicated device. The dedicated device includes a slot for inserting an IC card, and the user performs authentication by inserting the IC card owned by the slot.
[0042]
Such a configuration using a dedicated device can be applied to a bank ATM machine, a game machine in a game center, and the like.
[0043]
Regarding the acquisition of the access ticket 18 by the user, a common center that issues the access ticket 18 generates and distributes it in response to an issuance request from the user, and the creator of the application program accesses the access ticket issuing program and the access There is a method of generating individually with the help of the ticket generating device 12.
[0044]
In such a case, the access ticket generation device 12 is managed by a ticket issuer, and the access ticket 18 is created and distributed separately from the user environment by these right holders.
[0045]
The generated access ticket 18 may be delivered to the user via a portable storage medium such as a floppy disk. However, since the access ticket 18 has sufficient security, e-mail or the like is used. It may be configured to be delivered via a network.
[0046]
The security of the access ticket 18 has the following two properties.
[0047]
1) The access ticket is a registered expression. That is, only the user himself / herself who issued the access ticket (more precisely, the holder of the user-specific information used when generating the access ticket) can correctly operate the proof data generation apparatus using the access ticket. Therefore, even if a malicious third party illegally obtains another user's access ticket, unless the third party obtains the user-specific information of the legitimate user to whom the access ticket is issued It is impossible to use this access ticket.
[0048]
2) The access ticket has a stricter security. In other words, a malicious third party collects an arbitrary number of access tickets and does any analysis, forges another access ticket based on the obtained information or imitates the operation of the proof data generation device Thus, it is impossible to configure a device that establishes authentication.
[0049]
[Specific configuration]
Hereinafter, a more specific configuration will be described in accordance with an embodiment. In this embodiment, a configuration example in the case of applying an access ticket to a signature scheme based on a general discrete logarithm problem described below is shown.
[0050]
The signature method used in the embodiment of the present invention uses a finite group G (denoted in a multiplicative manner) in which the discrete logarithm problem is difficult in terms of computational complexity and an element g having an order n.
[0051]
Signing key x is the original residue class ring Z / nZ by law n rational integer ring, verification key y is a finite group G in the original satisfying y = g ^x.
[0052]
The signature for the element m of the remainder class ring Z / nZ is composed of two elements r and s of Z / nZ.
[Expression 2]
(1-1) r = H (g ^{ry s} , m)
Given in. Here, the function H is an arbitrary two-variable function that determines the element H (a, b) of the remainder class ring Z / nZ from the element a of the finite group G and the element b of the remainder class ring Z / nZ. Signatures r and s are as follows.
[0054]
[Equation 3]
r = g ^k
s = k−r′x
However, r ′ = H (m, r), and a random number k∈Z / nZ.
[0055]
FIG. 2 shows a configuration example of the proof data verification device 10 and the proof data generation device 11 of this embodiment, and FIG. 3 shows a detailed configuration centering on the signature generation unit of the proof data generation device 11. FIG. 4 shows the operation of this embodiment. In FIGS. 2 and 3, portions corresponding to those in FIG.
[0056]
In FIG. 2, the proof data verification device 10 includes a verification unit 13, a verification key storage unit 21, a random number generation unit 22, an authentication data storage unit 23, and a signature storage unit 24. The proof data generation device 11 includes a signature data generation unit 15, a pre-signature data generation unit 16, a user specific information storage unit 25, an access ticket storage unit 26, a verification key storage unit 27, and an authentication data storage unit 28. It consists of
[0057]
Now, in order to identify a user, the user specific information e which is a different number for every user is defined. e is stored in the user specific information storage unit 25. The pre-signature generation unit 16 and the user specific information storage unit 25 are accommodated in a defense means (also referred to as a token) 29.
[0058]
FIG. 3 mainly shows a detailed configuration of the pre-signature generation unit 16 and the signature generation unit 15 of the proof data generation device 11 of FIG. That is, the pre-signature generation unit 16 in FIG. 2 includes a random number generation unit 30, an auxiliary signature key storage unit 31, a first pre-signature generation unit 16A, and a second pre-signature generation unit 16B. Further, the signature generation unit 15 of the proof data generation device 11 of FIG. 2 includes a first signature generation unit 15A and a second signature generation unit 15B. Further, the proof storage unit 24 of the proof data verification device 10 of FIG. 2 includes a first signature storage unit 24A and a second proof storage unit 24B.
[0059]
The access ticket t is generated based on the following expression 1-2.
[0060]
[Expression 4]
(1-2) t = x−f (e, y) mod N
Here, N is an arbitrary multiple of n. Of course, when N = 0, (1-2) is performed on the rational integer ring. As representative elements representing elements of the remainder class ring Z / nZ, 0, 1, 2,. . . , N−1, these are regarded as integers if necessary.
[0061]
The function f is a function in which the function values do not collide with each other, and can be defined as in Expression 1-3 using the one-way hash function h, for example.
[0062]
[Equation 5]
(1-3) f (x, y) = h (x | y)
Here, x | y represents a bit concatenation of x and y.
[0063]
The one-way hash function is a function having a property that it is extremely difficult to calculate different x and y satisfying h (x) = h (y). As an example of a one-way hash function, RSA Data Security Inc. MD2, MD4, MD5, and the standard SHS (Secure Hash Standard) by the US federal government are known.
[0064]
Hereinafter, the data m generated for authentication by the proof data verification device 10 is referred to as authentication data, and the signatures r and s generated for verification by the proof device are referred to as proof data.
[0065]
The operation of this embodiment will be described below.
[0066]
[Step 1] When the user accesses a program (digital content) that requires authentication by the program execution control device (access qualification authentication device), the proof data verification device 10 is activated.
[0067]
When the proof data verification device 10 is configured as a part of an application program that operates on the user's PC or workstation, the user starts the application program by a normal method using an instruction device such as a keyboard or a mouse. . When the execution of the application program reaches the program constituting the proof data verification device 10, the proof data verification device 10 is activated.
[0068]
When the proof data verification device 10 is configured on another PC or workstation (called a server) connected by a network, the user starts a communication program on his PC or workstation, and the communication program By making a communication establishment request to the server according to a predetermined procedure, the proof data verification device 10 on the server is activated. For example, if a user communication program follows a procedure called TCP / IP when communicating with a server, the proof data verification device is associated with a specific port of the server in advance, and the user communication program further sets the port. By specifying and setting to request a TCP connection request to the server, a daemon (inetd) on the server can start the proof data verification device 10 in response to the TCP connection request. Such an implementation method is widely used in networks such as the Internet.
[0069]
The proof data verification device 10 may be a dedicated device. For example, the proof data verification device 10 can be configured as a program burned in a ROM in an IC card reader / writer, and the proof data generation device 10 can be a program mounted on a microcontroller of the IC card. In this case, when the user inserts the IC card into the reader / writer, the certification data verification device 10 is activated.
[0070]
[Step 2] The proof data verification device 10 generates authentication data m and writes it in the authentication data storage unit 23. The authentication data m is generated so as to have a different value each time. In this embodiment, the proof data verification device 10 has a random number generation unit 22 and writes the random number generated by the random number generation unit 22 to the authentication data storage unit 23 as authentication data m.
[0071]
Further, the authentication data m and the verification key y stored in the verification key storage unit 21 are written to the verification key storage unit 27 and the authentication data storage unit 28 for storing received data in the proof data generation device 11. .
[0072]
[Step 3] The random number generation unit 30 in the proof data generation device 11 generates an appropriate random number k, stores k in the auxiliary signature key storage unit 31, and the first pre-signature generation unit 16A stores the finite group G. To raise the base g to the power of k and generate the first pre-signature r ′. The first pre-signature r ′ satisfies Equation 1-4.
[0073]
[Formula 6]
(1-4) r ′ = g ^k
[0074]
[Step 4] The first signature generation unit 15A of the proof data generation device 10 includes the authentication data m stored in the authentication data storage unit 28 and the first pre-signature generated by the first pre-signature generation unit 16A. A first signature r is generated from the signature r ′ using the two-variable function H, and is written in the first signature storage unit 24A in the proof data verification device 10. The first signature r satisfies Equation 1-5.
[0075]
[Expression 7]
(1-5) r = H (m, r ′)
[0076]
[Step 5] The second pre-signature generation unit 16B in the proof data generation device 11 includes the auxiliary signature key k stored in the auxiliary signature key storage unit 31 and the first signature generated by the first signature generation unit 15A. A second pre-signature s ′ is generated by using Equation 1-6 from r, the user unique information e stored in the user unique information storage unit 25 and the verification key y stored in the verification key storage unit 27.
[0077]
[Equation 8]
(1-6) s ′ = k−rf (e, y)
[0078]
[Step 6] The second signature generation unit 15B in the proof data generation device 11 includes the second pre-signature s ′ generated by the second pre-signature generation unit 16B and the first signature generation unit 15A. A second signature s is generated from the signature r of 1 and the access ticket t stored in the access ticket storage unit 26 using the expression 1-7, and stored in the second signature storage unit 24B in the proof data verification device 10 Write.
[0079]
[Equation 9]
(1-7) s = s′−rt
[0080]
[Step 7] The verification unit 13 in the proof data verification device 10 includes the authentication data m stored in the authentication data storage unit 23, the verification key y stored in the verification key storage unit 21, and the first signature storage unit. From the first signature r stored in 24A and the second signature s stored in the second signature storage unit 24B, the calculation of Formula 1-1 (r = H (g ^{ry s} , m)) is performed. To verify.
[0081]
Only when the combination of the access ticket t and the user specific information e used in the proof data generation device 11 is correct, the verification formula is established and the verification is performed correctly.
[0082]
The bivariate function H in the present embodiment is expressed by using, for example, the hash function h.
[Expression 10]
(1-8) H (a, b) = h (b | a)
Thus, with the above configuration, an access ticket with a so-called Schnorr signature can be realized. FIG. 7 shows the operation of realization by the Schnorr signature access ticket.
[0084]
In this case, the first signature generation unit 15A in the proof data generation device 11 and the verification unit 13 in the proof data verification device 10 may have a function of calculating the hash function h.
[0085]
Further, the bivariate function H is converted, for example, from an element b of the finite group G to an element {b} of the remainder class ring, and addition is performed on a and the remainder class ring.
[0086]
[Expression 11]
(1-9) H (a, b) = a + {b}
By doing so, it is possible to realize a so-called message restoration type Nyberg-Ruppel signature access ticket with the same configuration. FIG. 8 shows an operation of realizing an access ticket with a Nyberg-Ruppel signature.
[0087]
This is the end of the description of the embodiment. In addition, this invention is not limited to the above-mentioned Example, A various change is possible. For example, in the above embodiment, the access ticket is supplied to the proof data generation device, the signature is generated in the proof data generation device, and the signature is sent to the proof data verification device. However, the access ticket is supplied to the proof data verification device. Alternatively, a part of the signature or a pre-signature may be sent as proof data to the proof data verification device, and the proof data verification device may generate the signature for verification. Further, an integrated access qualification authentication device may be configured without distinguishing between the proof data verification device and the proof data generation device, and authentication may be performed by supplying user-specific information and an access ticket to this device. Further, by generating a unique signature key (access ticket) from the signature key and user specific information and sending it to the user, the signature key can be safely distributed.
[0088]
【The invention's effect】
As is clear from the above description, according to the present invention, by introducing the unique signature key (access ticket), the characteristic information of the access qualification authentication and the user specific information can be made independent. The user only needs to prepare one piece of unique information.
[0089]
An access ticket is data calculated based on specific information of a specific user and characteristic information of access credential authentication, and also calculates characteristic information of access qualification authentication from the access ticket without knowing the user specific information. It is difficult. The correct proof data is calculated only when the correct combination of the user-specific information and the access ticket, that is, the combination of the user-specific information and the access ticket calculated based on the user-specific information is input. . Therefore, the user holds the unique information in advance, and the protector such as the program creator prepares the characteristic information of the access qualification authentication independently of the unique information possessed by the user, and creates the access ticket as the user's unique information and application program. It is possible to authenticate the access qualification of the user such as execution control by creating and distributing it according to the characteristic information of the access credential authentication used for the above.
[0090]
Further, according to the present invention, it is possible to safely distribute the signature key, and it is possible to realize a simple key deposit mechanism.
[Brief description of the drawings]
FIG. 1 is a diagram showing an overall configuration of an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration of a proof data verification device and a proof data generation device according to the embodiment.
FIG. 3 is a block diagram illustrating a detailed configuration of a proof data verification device and a proof data generation device according to the embodiment.
FIG. 4 is a diagram for explaining the operation of the embodiment.
FIG. 5 is a diagram for explaining the operation of the embodiment.
FIG. 6 is a diagram for explaining the operation of the embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 Certification data verification apparatus 11 Certification data generation apparatus 12 Access ticket generation apparatus 13 Verification means 14 Authentication data 15 Signature data generation means 16 Pre-signature data generation means 17 User specific information 18 Access ticket 21 Verification key storage part 22 Random number (for authentication Data) Generation unit 23 Authentication data storage unit 24 Signature storage unit 25 User specific information storage unit 26 Access ticket storage unit 27 Verification key storage unit 28 Authentication data storage unit

Claims (19)

In an access credential authentication device that authenticates a user's access qualification by verifying the validity of a signature generated to prove the user's authority,
First storage means for storing user specific information e;
Second storage means for storing auxiliary information t obtained by executing a predetermined calculation on the user's unique information e and signature key x;
A first partial operation result for signature is generated by executing the first partial operation for signature without using the message to be signed , using the unique information e of the user held in the first storage means Means for generating
A second partial operation for signature is executed using the auxiliary information t , the partial operation result for signature and the message to be signed held in the second storage means to generate a final operation result . Two generating means;
Verification means for verifying whether the final operation result generated by the second generation means is a valid signature ;
The signature first partial operation by the first generation means and the second partial operation for signature by the second generation means are selected to cooperate to generate the signature , and The access qualification authentication apparatus, wherein the predetermined calculation is selected so that the final calculation result is a valid signature when the user's unique information e, the signature key x, and the auxiliary information correspond to each other. . 2. The at least first storage means and the first generation means are protected by a protection means that makes it difficult to observe internal data and processing procedures from the outside. Access credential authentication device. 2. The access qualification authentication apparatus according to claim 1, wherein at least the first storage means and the first generation means are configured as a portable small arithmetic device such as an IC card. The first generating means is
Third generation means for generating the auxiliary signature key k and the first partial signature calculation result r ′;
Third storage means for storing the auxiliary signature key k;
And a fourth generation means for generating a second signature partial operation result s ′.
The second generating means is
Fifth generation means for generating a first signature r;
And sixth generation means for generating the second signature s,
The first signature r is calculated from the authentication data m and the first partial signature calculation result r ′.
The second partial signature calculation result s ′ is calculated from the auxiliary signature key k, the first signature r, the user specific information e, and the verification key y.
4. The second signature s is calculated from the second signature partial calculation result s ′, the first signature r, and the auxiliary information t. Access credential authentication device. The signing key x is an element of a residue class ring Z / nZ by a rational integer ring modulus n, and the verification key y is y = g ^x for a finite group G that defines a discrete logarithm problem and an element g of order n. 5. The access qualification authentication apparatus according to claim 4, wherein the access qualification authentication apparatus is an element of a finite group satisfying the above. 6. The access qualification authentication apparatus according to claim 5, wherein the finite group G is a multiplicative group of a finite field. The verification means includes that the authentication data m, the first signature r, and the second signature s are r = H (g ^{ry s} , 6. The access qualification authentication apparatus according to claim 5, wherein when the relationship equivalent to m) is satisfied, it is determined that the signature is valid. 8. The access qualification authentication apparatus according to claim 7, wherein the two-variable function is a value of a non-collision function having an input obtained by connecting data determined from a finite group element and authentication data. 8. The access qualification according to claim 7, wherein the two-variable function is a value obtained by adding an element of a remainder class ring Z / nZ by a modulus n of a rational integer ring determined from an element of a finite group and authentication data. Authentication device. The auxiliary information held in the second storage means is based on the signature key, the verification key, the user specific information, and the non-collision function.
t≡x−f (e, y) (mod N)
8. The access qualification authentication apparatus according to claim 1, wherein the access qualification authentication apparatus is defined so as to satisfy (where N is an arbitrary multiple of n). 8. The access qualification authentication apparatus according to claim 1, wherein the first generation unit and the verification unit can execute a finite group G calculation. 8. The access qualification authentication apparatus according to claim 1, wherein the second generation unit and the verification unit can calculate a two-variable function H. The third generation means generates a random number k as an auxiliary signature key and stores the random number k in the third storage means. The base g of the group G is raised to the kth power by the auxiliary signature key k and the first signature partial calculation result calculate r ′ = g ^k ,
The fifth generation means calculates the first signature r = H (m, r ′) by the two-variable function H with the authentication data m and the first signature partial calculation result r ′ as inputs. And
The fourth generating means, said first signature r and specific information e and the ones obtained by multiplying the non-collision function value of the verification key y is subtracted from the auxiliary signing key signature the second of the user The partial operation result s ′ = k−rf (e, y) is calculated,
The sixth generation means subtracts the product of the first signature r and the auxiliary information t from the second partial signature calculation result s ′ to obtain a second signature s = s′−rt. The access qualification authentication apparatus according to any one of claims 4 to 12, wherein the access qualification authentication apparatus is calculated. 14. The access qualification authentication according to claim 1, wherein the verification means includes a random number generation means, and the random number generation means writes the generated random number as authentication data in the fourth storage means. apparatus. 15. The access qualification authentication apparatus according to claim 14, wherein the verification unit verifies a signature with respect to the authentication data which is the random number. 16. The access qualification according to claim 14 or 15, wherein the authentication data is an output G (m ') when the random number m' generated by the random number generation means is input to the non-collision function G. Authentication device. The proof data generation device includes at least the first storage unit, the second storage unit, the first generation unit, and the second generation unit, and the proof data verification device includes at least The proof data verification means, a fourth storage means for storing the authentication data, and a fifth storage means for storing the proof data, wherein the proof data generation device and the proof data verification device are: In an access credential authentication device that authenticates user access qualification by communicating with each other,
The proof data verification device writes the authentication data stored in the fourth storage means to the sixth storage means of the proof data generation device,
The proof data generation device writes a signature generated based on the authentication data written in the sixth storage unit by the second generation unit to the fifth storage unit in the proof data verification device. ,
The access credential authentication apparatus according to any one of claims 1 to 16, wherein the proof data verification apparatus authenticates a user's access qualification using the signature written in the fifth storage means. In an access credential authentication method for authenticating a user's access credential by verifying the validity of a signature generated to prove the user's authority,
A first storage means for storing a user's unique information e;
A second storage step in which a second storage means stores auxiliary information t obtained by executing a predetermined calculation on the user's unique information e and signature key x;
The first generation means executes the first partial operation for signature without using the signature target message by using the unique information e of the user held in the first storage step, and the signature portion A first generation step for generating a calculation result ;
The second generation means executes a second partial operation for signature using the auxiliary information t, the partial operation result for signature, and the message to be signed held in the second storage step. A second generation step for generating a final operation result ;
A verification unit has a verification step of verifying whether the final operation result generated in the second generation step is a valid signature ;
In cooperation and second portions calculation for the signature of the first part operation and the second generating step for the signature by the first generating step is selected to generate the signature, further the The access qualification authentication method, wherein the predetermined calculation is selected so that the final calculation result is a valid signature when the user's unique information e, the signature key x, and the auxiliary information correspond . First storage means for storing user specific information e;
Second storage means for storing auxiliary information t obtained by executing a predetermined calculation on the user's unique information e and signature key x;
A first partial operation result for signature is generated by executing the first partial operation for signature without using the message to be signed , using the unique information e of the user held in the first storage means Means for generating
A second partial operation for signature is executed using the auxiliary information t , the partial operation result for signature and the message to be signed held in the second storage means to generate a final operation result . Two generation means,
The signature first partial operation by the first generation means and the second partial operation for signature by the second generation means are selected to cooperate to generate the signature , and Furthermore, the predetermined calculation is selected so that the final calculation result becomes a valid signature when the user's unique information e, the signature key x, and the auxiliary information correspond to each other .

Images